I read the following blog post about implementing custom user log in:


In the post, the author walks through some PHP code for logging in a user via a form while checking a nonce.

My understanding is that nonces are used to prevent CSRF attacks -- that is, to prevent logged in users from being tricked into taking some action without realizing it. But if the user is not logged in... Is the nonce accomplishing anything?

Do all non-logged-in users get the same nonce? I can't think of how else they would be implemented. I guess a nonce could be useful if some imporant action is taken as a direct result of logging in... but if all guests visiting the login form get the same nonce, then a CSRF attack would still be trivial to execute, wouldn't it?

I'm still learning about security stuff, and am finding this quite confusing.

  • 1
    A nonce is based on the user ID. And that is 0 prior to the login. So using it there is of course just wasted time. :) – fuxia Aug 24 '19 at 12:32
  • Ok, that's what I thought. Thanks for confirming. – Jesse Aldridge Aug 24 '19 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.